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Abstract 

A methodology is presented for the design of 
flight control systems that exhibit stability and 
performance- robustness in the presence of actuator 
failures. The design is based upon two elements. 
The first element consists of a control law that will 
ensure at least stability in the presence of a class of 
actuator failures. This law is created by inner-loop, 
reduced-order, linear dynamic inversion, and outer- 
loop compensation based upon Quantitative Feedback 
Theory. The second element consists of adaptive 
compensators obtained from simple and approximate 
time-domain identification of the dynamics of the 
"effective vehicle" with failed actuator(s). An 
example involving the lateral-directional control of a 
fighter aircraft is employed both to introduce the 
proposed methodology and to demonstrate its 
effectiveness and limitations. 

Introduction 

The ability of an aircraft to survive with 
failed or damaged actuation systems is an important 
consideration for safety of flight. The 
accommodation of such failures is typically sought 
through reconfigurable or adaptive control systems. 
Many examples of research in this area can be found 
in the literature, e.g., Refs. 1-5. The work to be 
described herein builds upon a design methodology 
introduced in Ref. 5 . The fundamental philosophy of 
that work was that an adaptive/reconfigurable design 
should be an integral part of a robust flight control 
methodology. This philosophy allows the nominal 
flight control system to share a considerable part of 


the responsibility for performance recapture when 
actuators are damaged or fail and allows the adaptive 
system time for identification and reconfiguration. 

The work or Ref. 5 dealt with a single-input, 
single-output (SISO) system involving a longitudinal 
flight control design with redundant effectors. The 
nominal flight control system was based upon a 
Quantitative Feedback Theory design emulated by a 
simplified Pre-Design Technique (PDT) described in 
Ref. 6. The adaptive logic was implemented as an 
iterative gain adjustment in the single PDT 
compensator. While effective in improving 
performance in the presence of a class of actuator 
failures, the adaptive technique suffered from long 
convergence times during which the pilot was 
excluded from control. This deficiency eliminated 
this approach for consideration for multi-input, multi- 
output (MIMO) designs. The work to be described 
herein will attempt to remove this limitation and to 
provide a more powerful adaptive technique than 
simple gain adjustment. 

Reconfiguration Methodology 
The reconfiguration approach to be discussed 
involves an approximate, time-domain identification 
of the dynamics of the "effective vehicle" where the 
term "effective" implies that the nominal flight 
control law remains in operation. The identification 
produces input-response transfer functions and is 
accomplished while the pilot is excluded from active 
control. After identification, additional outer control 
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loops are enabled that utilize compensation elements 
derived from the identified effective vehicle 
dynamics. No additional sensor requirements are 
encountered as the outer- loop feedback variables are 
the vehicle response variables already used by the 
PDT compensation elements. Immediately after 
enabling these loops, control is returned to the pilot. 
The philosophy behind this approach is to simplify 
the reconfiguration as much as possible, and to leave 
the nominal flight control system undisturbed so as to 
preserve its robustness. The latter is an important 
consideration in minimizing the trim upsets that may 
accompany certain actuator failures, e.g., non-null 
failures. Note that if the actuator failures involve 
nonlinearities that are encountered in the step test 
inputs, their effects will be reflected in the resulting 
control adaptive compensation. For example, an 
actuator failure that causes a significant reduction in 
the device’s rate-limits may result in an additional 
apparent time delay in the vehicle’s step response. 7 
As will be seen, this delay is one of the parameters 
estimated in the identification procedure. As in Ref. 
5, it is assumed that redundant controls are in 
evidence, i.e., in any control loop subject to 
reconfiguration, at least two effectors are involved in 
the control of each outer-loop response variable. 

Example 

From a tutorial standpoint the design 
methodology is best described through an example. 
This will involve the design of a lateral-directional 
flight control system for a simple model of the 
former NASA High- Angle of Attack Research 
Vehicle (HARV). This model was chosen since 
model details and the nominal control system design 
are available in the literature. 4 ’ 9 * 10 The vehicle is 
shown in Fig. 1 with the five control effectors 
employed in the control law. In the design discussed 
in Ref. 10, the linear, dynamic inversion was gain 
scheduled for 18 flight conditions. For the purposes 
of exposition, only a single flight condition will be 
utilized herein. This condition is Mach No. = 0.6, 
Altitude = 20,000 ft. The flight control system 
configuration is shown in Fig. 2. Figure 3 
summarizes the steps in the design methodology to be 
described. 

Define Flight Conditions 

The linear dynamic inversion control law, as 
described in Ref. 10 was gain-scheduled over 18 
flight conditions, ranging from Mach No. = 0.2, Alt. 


= 10,000 ft to Mach No. = 0 . 9 , Alt. = 30,000 ft. 
Table 1 gives the dynamics of the simplified vehicle 
model for the single flight condition discussed herein. 
Also listed are the dynamics of the five actuators, 
including amplitude and rate limits. 

Design Reduced-Order, Linear Dynamic Inversion 
Laws 

Since the dynamic inversion here is reduced - 
order, full-state feedback including actuator states is 
not required. 9 Feedback of only rigid body states, 
roll-rate p, yaw-rate r, and sideslip beta is required. 
The inversion law provides an approximately 
decoupled control law with first-order-like command- 
response characteristics. In this formulation, roll 
control is about the velocity vector. As the name 
implies the control distribution matrix in Fig. 2 
distributes the two pseudo control commands to the 
five actuators. This matrix is implemented with only 
a single non-zero element in any row. The non-zero 
element is proportional to the rate limit of the 
actuator that it affects. As seen in Table 1, the 
control distribution matrix selects aileron, differential 
tail and roll thrust vectoring for control of roll-rate, 
and rudder and yaw-thrust vectoring for control of 
sideslip. If desired, this definition allows use of the 
"software rate limiters" discussed in Ref. 11. For 
simplicity, these limiters were not included in the 
present study. 

Define Actuator Failure Class 

The class of actuator failures is shown in 
Table 2. As can be seen, 30 failures were included, 
with 28 of the failures defined as a gain reduction 
and/or time delay addition to the linear actuator 
description(s), one including a biased control surface 
position and one involving a failure with a 95% 
reduction in actuator rate limits. While the gain 
reductions model loss of actuator effectiveness, the 
inclusion of pure time delays is admittedly somewhat 
artificial. However, these failure modes were 
included to provide both amplitude and phase 
variations in the frequency -domain description of the 
actuators. 

Design QFT/PDT Compensators and Prefilters 

After the dynamic inversion laws were 
created, the QFT/PDT compensators were obtained. 
The purpose of these compensators was to provide 
stability and performance robustness for the nominal 
vehicle (no actuator failures) across the flight 
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envelope and to provide at least stability robustness 
for cased in which actuator failures occurred. 
Although actuator failures, per se , were not included 
in the study of Ref. 10, model uncertainty was 
introduced in the formulation by creating 10 
additional vehicle models at each flight' condition. 
These additional models were obtained by perturbing 
the stability derivatives in the nominal configuration 
by a maximum of 20%. The QFT/PDT diagonal 
compensation matrix was then obtained by the loop 
shaping procedure described in Ref. 6. These 
compensation elements are given by 
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where v a and v are the first and second inputs to 
the dynamic invertor as shown in Fig. 2 and y x and y 2 
represent the excess poles over zeros offp/vp^ 
and (p/v 2 ) ww , respectively. The relations of Eqs. 1 
ensure that the well-known, desirable frequency 
domain attributes of a loop transmission will be in 
evidence in each of the (approximately) decoupled 
control loops of Fig. 2. 12 No changes in the resulting 
compensator matrix (s) were required to 
accommodate the 30 linear failures of Table 2, for 
the single flight condition considered here. This 
assessment was based upon actuators with no 
amplitude or rate limitations. Of course, the ability 
of the reconfiguration scheme to handle any of the 
failures with rate and amplitude limited actuators 
(healthy or failed) had to be ascertained through the 
computer simulation to be described. The diagonal 
elements of the prefilter matrix shown in Fig. 2 were 
created to provide acceptable handling qualities for 
the nominal vehicle across the 18 flight conditions 
using the predictive methodology introduced in Ref. 
13. 


The bode diagrams of the transfer functions 
between command and response variables for the 
vehicle with damaged actuators are shown in Figs. 4- 
7 for all but Configs. 30-31 where nonlinearities or 


control offsets are involved. As the figures indicate, 
significant variations in the vehicle dynamics have 
been introduced by the class of actuator failures. 


Formulate Identification Logic 

The identification of the "effective vehicle" 
with both the dynamic inversion controller and the 
QFT/PDT controllers in place was accomplished by 
applying successive test inputs in the beta and p loops 
as shown in Fig. 2. The identification is predicated 
on the step response. The test inputs for this 
example are shown in Fig. 8. A doublet is used for 
the p loop to bring the aircraft back to the 
approximate roll attitude that existed when the 
reconfiguration began. The identification logic was 
kept as simple as possible herein. This approach will 
attempt to capitalize on the fact that the action of the 
dynamic inversion and PDT control laws will allow 
the transient responses (linear or nonlinear) to the test 
inputs to be fitted with a pair of relatively simple, 
lower-order models, characterizing either an 
underdamped , or overdamped response. These 
models are defmed as 

Underdam ped-type responses 
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The parameters of the model of Eqs. 2 and 
3 are estimated from the transient responses as 
indicated in Fig. 9 and 10. The "gain" K was not 
estimated but was always assumed to be unity. This 
assumption is justified since the PDT compensation 
always provides at least a type "1" system, i.e. at 
least one pole at the origin of the loop transmissions P/e p 
and pfe p in Fig. 2. This in turn guarantees zero 
steady-state error to the test step input. Although not 
pursued in this example, the effects of any turbulence 
or sensor noise on the step responses can be lessened 
by the common practice of filtering the responses 
recorded off-line, first in forward time, then in 
reverse time. This process effectively removes any 
lags in the filtered responses due to filtering. It 
should also be noted that the x d identified as in Figs. 
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9 and 10 can accommodate the "reverse action" 
associated with high frequency (above crossover) 
non-minimum phase zeros in the damaged vehicle 
response. It should also be noted that the model fits 
above may give relative poor matches [o the actual 
vehicle time responses but still yield an acceptable 
reconfigurable compensator. Although approximate 
and simple in form, the identification logic has the 
advantage of requiring little computational effort. In 
addition, the effects of nonlinear failed-actuator 
behavior, if encountered in the test step inputs, will 
be reflected in the adaptive compensation. Finally, 
it is obvious that other more sophisticated schemes 
can be for identification. 


Create Adaptive, Outer-Loop Compensators 

The outer loop compensators G^(s) and 
G ( s ) are created as follows: 
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Here, (|$/p c )^ refer t0 ^ dynamics 

identified from Eqs. (2) or (3) with the time delay 
removed and padded with extra high-frequency zeros 

so that both ((S/p e ) and Ipl p c )^ contain two more 

zeros than poles. The lead term (r d s+l) is included 
to reduce the phase lags attributable to the time delay 
x 4 . To ensure adequate stability margins, the 
crossover frequencies for each of the outer loops 
were chosen initially as 

a) = min[2.0, 0.5 /tJ (5) 


The crossover frequency so obtained is an estimate, 
since it is based upon an exact cancellation of the 
vehicle dynamics by those estimated from the 
identification procedure. Just as in the case of the 
QFT/PDT compensators, the adaptive, outer-loop 
compensation ensures that the well-known, desirable 
frequency -do main attributes of a loop transmission 
will be in evidence in each of the (approximately) 
decoupled control loops of Fig. 2. 


Simulation 

A computer simulation of the reconfigurable 
control system was conducted. The simulation 
involved models of compensatory pilot behavior in 
the beta and p loops as described in Ref. 13. The 
pilot models are given in Table 3 along with the 
assumed dynamics of the cockpit force/feel systems 
for the lateral stick (providing roll-rate command p c ) 
and rudder pedals (providing sideslip command P c ). 
With the nominal (undamaged) aircraft, the pilot 
models of Table 3 yielded crossover frequencies of 
1.5 rad/sec in each loop. A block diagram 
representation of the pilot/vehicle system is shown in 
Fig. 11. No changes in the pilot dynamics were 
allowed after failure or reconfiguration. 

The scenario for pilot-in-the-loop 
reconfiguration went as follows: 

1. ) ' A failure is detected. The detection logic is 

beyond the scope of this study. No isolation or 
identification of the particular actuator(s) affected is 
assumed. 

2. ) Pilot inputs are removed from the system 
and a 5 sec quiescent period follows to allow 
transients to die out. 

3. ) The test inputs of Fig. 8 are employed. The 

p-loop is reconfigured first and the reconfigured p- 
loop compensator is brought on-line at the completion 
of the 10 sec doublet. Time for identification and 
reconfiguration was considered negligible and 
ignored. After the doublet was completed, another 5 
sec quiescent period is employed. The beta-loop is 
reconfigured next. Note that the beta loop dynamics 
are identified and reconfigured with the reconfigured 
p loop in operation. The reconfigured beta-loop is 
brought on line immediately at the conclusion of the 
5 sec beta-test pulse. Selection of loop closure 
sequence was based upon the fact that the beta loop 
is serviced by only two actuators, and reconfiguration 
of the p loop would reduce the demands upon the 
remaining healthy actuator in the beta loop should 
one of them have failed. 

4. ) A third, 5 sec quiescent period is employed 

after which control is returned to the pilot. The 
entire reconfiguration time is thus 30 sec. 
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The design summary of Figure 3 indicates 
some iterative modification of the adaptive, outer- 
loop compensation may be necessary. Here these 
modifications consisted of the following: 

a. ) The crossover frequency logic of Eq. 5 for 

the beta loop was changed to 

a) = min[1.0, 0.5 /t ,] (6) 

c 9 u c 

Lowering the constant from 2 in Eq. 5 to 1 in Eq. 6 
led to better ~ reconfigured performance, a fact 
attributable to the relatively simple approximation for 
the overdamped response types that dominated the 
beta responses to the beta test input. 

b . ) Logic was incorporated to prevent adaptation 

in those instances in which the robustness of the 
dynamic inversion law and the QFT/PDT controller 
provided sufficient performance robustness. The 
logic for each loop was as follows: For 

underdamped responses, if the overshoot was less 
than or equal to 5%, no reconfiguration was 
undertaken; for overdamped response, if the 2% 
settling time was less than or equal to 4 sec, no 
reconfiguration was undertaken. 

Results 

As Fig. 11 indicates, in evaluating the 
reconfiguration design, a roll-attitude command was 
given to the pilot. This random appearing command 
was obtained as the sum of five sinusoids and 
produced a signal with an root-mean-square (RMS) 
value of 10 deg. Although no beta command was 
provided, the pilot was assumed to be actively 
attempting to null beta errors caused by inevitable 
dynamic cross-coupling from the roll-attitude control 
activity. 

One instability was obtained in simulation of 
the 30 actuator failure cases. This was Config. 13. 
In this case, no reconfiguration occurred. The 
instability was traced to the effects of actuator 
saturation. The effects of this saturation were not 
included in the original stability study that created 
the PDT compensators. Thus, this failure would 
have to be removed from the actuator failure class. 
Of the 30 failures, nine resulted in no reconfiguration 
being attempted in either loop, six resulted in 
reconfiguration in both loops, with the remaining 15 
resulting in reconfiguration in one loop only and 13 


of these 15 involved reconfiguration in the beta loop. 

Space does not permit a discussion of each 
of the failures. In general, performance was 
improved in all cases where at least one of the loops 
reconfigured. Two challenging failures can be 
selected for presentation however, Configs. 9 and 31 . 
First, Figs. 12 and 13 show the tracking performance 
of the pilot/vehicle system with the nominal vehicle 
(Config. 1). Note that the higher frequency sinusoids 
in the roll command input provide a challenging 
tracking task. Figures 14 and 15 compare the roll 
and beta tracking with and without reconfiguration 
for Config. 9 where no reconfiguration occurred in 
the beta loop but did occur in the p-loop. Both 
figures show significant improvement in tracking 
performance. Figures 15 and 16 compare the roll 
and beta tracking with and without reconfiguration 
for Config. 31, where reconfiguration occurred in 
both • loops. The most significant performance 
improvement is seen to come in the beta-loop 
tracking. This is in spite of the fact that a roll- 
control actuator (aileron) was the failed device. 
Figure 18 shows the 5 deg/sec aileron rate limiting 
occurring after reconfiguration. 

The price to be paid for the simplicity of the 
lower-order models of Eqs. 2 and 3 is, of course, 
modeling errors. As an example, Figs. 19 and 20 
show "identified" and "failed" vehicle models for a 
particular configuration. To allow meaningful 
comparison, all actuator limitations were removed. 
As can be seen, the lower-order models provide a 
relatively poor approximation to the actual, higher- 
order failed vehicle dynamics. However, it must be 
emphasized that system identification, per se, is not 
the goal of the methodology but is rather an 
intermediate step in establishing the dynamics of 
outer-loop compensators to improve system 
performance. Relatively poor frequency -domain 
matches can still provide acceptable plant inverse 
models for defining these compensators. 

Discussion 

The application of the proposed methodology 
to a simple aircraft model produces results superior 
to the methodology presented in Ref. 5. In that 
study, a SISO model of the longitudinal dynamics of 
the same aircraft at the same flight condition was 
employed. However, no inverse dynamic controller 
was used and only a single, inner-loop control was in 
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evidence based upon the QFT/PDT approach. SISO 
reconfiguration times averaged 25 sec* with the 
longest being 68 sec. In the present MIMO example, 
all reconfigurations were completed in 30 sec. 

The 30 sec reconfiguration time was 
deliberately selected as conservative in the present 
study. An examination of the vehicle responses to 
the pulsive step inputs indicates that the 5 sec test 
input duration can probably be halved as can the 5 
sec "quiescent" periods. Nonetheless, a lower limit 
of approximately 15 sec is the most one can probably 
achieve! 

Of primary importance in improving the 
methodology is increasing the quality of the 
procedure used to identify the dynamics of the 
effective vehicle with failed actuator(s). A first step 
would include an increase in the order of the models 
of Eqs. 2 and 3. The consequence of this order 
increment (and concomitant increment in accuracy) 
would be an increase in the maximum allowable 
crossover frequency in each reconfigured loop. 

Conclusions 

A flight control reconfiguration methodology 
based upon a two-element design approach has 
proved feasible in a limited evaluation. The 
methodology can accommodate significant and 
multiple actuator failures and requires no additional 
sensor requirements. The primary limitation of the 
technique is the requirement of eliminating pilot 
inputs while identification/reconfiguration is 
occurring. A significant improvement in the 
performance of the reconfigured system may be 
possible with a more sophisticated identification 
algorithm. 
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Table 1 Nominal Vehicle Model 


Mammal Elighi Condition: Alt. = 2Q.QQ0 ft Modi * 0.6 
x r (t) = A^it) * Bu(t) 

x r (t) = [PW pit) r(f)] r 


B 


-0.0142 

14.38 

0.3389 


uii) 

- ^ a ® r & kjv ^nvl r 


-0.166 0.0629 

-0.9971 

\ - 

-12.97 -1.761 

0.5083 


3.191 -.01417 

-0.1529 


-0.00686 0.01851 0 0.005817 

16.76 1.316 0.7007 0.0402 

-0.385 -1.051 -0.004475 -0.5511 


0 

0 

1.0 

0 

0.6 


1.0 

0 

0.6 

0 


differential tail : 


aileron : 


rudder : 


roll/yaw thrusr. 


Actuator Descriptions 


30 2 

s 2 +42.4s+30 2 

amplitude limit 
±17.5 deg 

75 2 

s 2 +88.5s+75 2 

±27.5 deg 

72 2 

s 2 +99.4s+72 2 

±30 deg 

20 2 

s 2 +24s+20 2 

±30 deg 


rate limit 
60 deg/s 

100 deg/s 

100 deg/s 

60 deg/s 


Control distribution matrix K included here with nonzero elements proportional to rate limits on actuators. 
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Table 2 Actuator Failures 


Failure No. 

Actuator(s) 

Failure Description 

1 

none 

healthy aircraft 

2 

differential tail 

complete failure (gain=0) 

3 

differential tail 

gain reduction (gain =0.5) 

4 

differential tail 

gain reduction (gain=0.5) + time delay (delay =0.4sec) 

5 

differential tail 

time delay (delay =0.4sec) 

6 

aileron 

complete failure (gain=0) 

7 

aileron 

gain reduction (gain =0.5) 

8 

aileron 

gain reduction (gain=0.5) + time delay (delay =0.4sec) 

9 

aileron 

time delay (delay =0.4sec) 

10 

rudder 

complete failure (gain=0) 

11 

rudder 

gain reduction (gain =0.5) 

12 

rudder 

gain reduction (gain=0.5) + time delay (delay =0.4 sec) 

13 

rudder 

time delay (delay =0.4sec) 

14 

roll thrust 

complete failure (gain=0) 

15 

roll thrust 

gain reduction (gain =0.5) 

16 

roll thrust 

gain reduction (gain=0.5) + time delay (delay =0.4sec) 

17 

roll thrust 

time delay (delay =0.4sec) 

18 

yaw thrust 

complete failure (gain=0) 

19 

yaw thrust 

gain reduction (gain=0.5) 

20 

yaw thrust 

gain reduction (gain=0.5) + time delay (delay =0.4sec) 

21 

yaw thrust 

time delay (delay =0.4sec) 

22 

yaw thrust + diff tail 

complete failure of both (gains =0) 

23 

rudder + diff tail 

complete failure of both (gains =0 

24 

yaw thrust 4* aileron 

complete failure of both (gains =0 

25 

rudder 4- aileron 

complete failure of both (gains =0) 

26 

yaw and roll thrust 

complete failure of both (gains =0) 

27 

rudder 4- roll thrust 

complete failure of both (gains =0) 

28 

roll thrust 4- aileron 

complete failure of both (gains = 

29 

aileron + diff tail 

complete failure of both (gains =0) 

30 

aileron 

complete failure (gain=0) + 2.5 deg offset 

31 

aileron 

gain reduction (gain=0.5) + time delay (delay =0.4 sec) + 5 deg/sec 
aileron rate limit 
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Table 3 Pilot Models 


beta-loop 

6.84 10 4 (5»l)g' O2f 

P> j(s+2)[j 2 +2(0.15)28.2s+28.2 2 ](j+39) 

D-lOOP 

2.610V 0 * 1 

"* " [s 2 +2(0. 15)14. ls+ 14.1 2 ][s 2 +2(0.78)28.9s+28.9 2 ] 

Pilot models contain force/feel system dynamics defined as 

25 ^ 

[s 2 + s(0.707)25s +25 2 ] 

All units normalized in pilot/vehicle system 


aileron 



Figure 1 The NASA HARV with lateral-directional control effectors 
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♦Switces open before Adaptive Controllers obtained and Adaptive Controllers = unity 


Figure 2 Flight Control System 



Figure 3 Steps in Design Methodology 


10 












beta command 



Response 


9 »*■ 
9 9 h 


bet * 



time (sec) 


Figure 13 beta-loop Tracking Performance 
Nominal System 



Figure 1 1 Pilot/Vehicle System for Computer 
Simulation 



Figure 14 phi-loop Tracking Performance; 
Config. 9 with and without Reconfiguraion 



Figure 12 phi-loop Tracking Performance 
Nominal System 



Figure 15 beta-loop Tracking Performance; 
Config. 9 with and without Reconfiguration 
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4 no reconfig 



Figure 16 phi-loop Tracking Performance; 
Config. 31 with and without Reconfiguration 



Figure 17 beta-loop Tracking Performance; 
Config. 31 with and without Reconfiguration 



Figure 18 Aileron Actuator Rate Limiting; 
Config. 31 After Reconfiguration 



Frequency (red/»ec) 


Figure 19 Comparison of Failed and Identified 
Vehicle Dynamics; beta loop, Linear 



Frequency (red/sec) 

Figure 20 Comparison of Failed and Identified 
Vehicle Dynamics; p loop, Linear 
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